A secure element (SE) is a physical component able to store data and to provide services in a secure manner. In general, a secure element has a limited amount of memory, a processor with limited capabilities and is devoid of battery. For instance a UICC (Universal Integrated Circuit Card) is a secure element embedding SIM applications for telecommunication purposes. A secure element can be installed, fixedly or not, in a terminal, like a mobile phone for example. In some cases, the terminals are constituted by machines that communicate with other machines for M2M (Machine to Machine) applications.
A secure element can be in the format of a smart card, or may be in any other format such as for example but not limited to a packaged chip as described in PCT/SE2008/050380, or any other format. A UICC can be used in mobile terminals in GSM and UMTS networks for instance. The UICC ensures network authentication, integrity and security of all kinds of personal data.
A smart card consists of a CPU, ROM, RAM, EEPROM and I/O circuits. Early versions consisted of the whole full-size (85×54 mm, ISO/IEC 7810 ID-1) smart card. Soon the race for smaller host device called for a smaller version of the card.
It is known to solder or weld the secure element in a host device, in order to get it dependent of this host device. This is done in M2M (Machine to Machine) applications. The same objective is reached when a chip (a secure element) containing a Payment application, SIM or USIM applications and files is contained in the host device. The chip is for example soldered to the mother-board of the host device or machine and constitutes an e-secure element (eSE).
The present invention applies also to such soldered eSEs or to such chips containing the same applications than the chips comprised in SEs. A parallel can be done for secure elements that are not totally linked to devices but that are removable with difficulty because they are not intended to be removed, located in host devices that are distant or deeply integrated in machines. A special form factor of the secure element (very small for example and therefore not easy to handle) can also be a reason to consider it as in fact integrated in a host device. The same applies when a secure element is integrated in a machine that is not intended to be opened.
In the next description, welded SEs or chips containing or designed to contain the same applications than secure elements will generally be called embedded secure elements (in contrast to removable secure elements). This will also apply to secure elements that are removable with difficulty.
A secure element is a physical component embedding a chip. In addition, the secure element contains a profile which includes a set of applications, a set of personal data and a set of secret data. The Operating System is executed on the chip for providing services. The set of applications is executed on the chip for providing services for the host device or a remote machine accessed through the host device. The set of personal data (like phonebook, ICCID or IMSI for an UICC) is stored in the physical memory of the chip used by the Operating System. The set of secret data (e.g. keys and PINs) is stored securely in a physical memory of the chip and used by the Operating System to provide secure services.
The profile could be linked to a subscription. It may contain network access applications (NAA), payment applications or third party applications providing security for a specific service (e.g. NFC applications).
A physical secure element can emulate several virtual secure elements, each one represented as one profile. In such a case, these profiles are called logical profiles or virtual profiles. An emulated profile is hereinafter called virtual profile. Usually each virtual profile is a software based profile.
The invention concerns a way to access several virtual profiles which are run in a single secure element.
In the state of the art, the basic behaviour to switch from a first virtual profile to another one is to physically reset the whole secure element (ex: reset as defined by ISO7816-3 standard for an smart card), and after this hardware reset, to execute the Operating System of the newly selected virtual profile. Thus only one virtual profile is active at a time in a device session.
There is a need to manage several virtual profiles simultaneously active and reachable outside the secure element.